Make it easier to bootstrap the PKI for SSL connections in OpenFlow.

[sliver-openvswitch.git] / secchan / secchan.8.in

diff --git a/secchan/secchan.8.in b/secchan/secchan.8.in
index c04e8d3..4fd2f24 100644 (file)
--- a/secchan/secchan.8.in
+++ b/secchan/secchan.8.in
@@ -341,6 +341,26 @@ private key to identify a trustworthy switch.
 Specifies a PEM file containing the CA certificate used to verify that
 the switch is connected to a trustworthy controller.
 
+.TP
+\fB--bootstrap-ca-cert=\fIcacert.pem\fR
+When \fIcacert.pem\fR exists, this option has the same effect as
+\fB-C\fR or \fB--ca-cert\fR.  If it does not exist, then \fBsecchan\fR
+will attempt to obtain the CA certificate from the controller on its
+first SSL connection and save it to the named PEM file.  If it is
+successful, it will immediately drop the connection and reconnect, and
+from then on all SSL connections must be authenticated by a
+certificate signed by the CA certificate thus obtained.
+
+\fBThis option exposes the SSL connection to a man-in-the-middle
+attack obtaining the initial CA certificate\fR, but it may be useful
+for bootstrapping.
+
+This option is only useful if the controller sends its CA certificate
+as part of the SSL certificate chain.  The SSL protocol does not
+require the controller to send the CA certificate, but
+\fBcontroller\fR(8) can be configured to do so with the
+\fB--peer-ca-cert\fR option.
+
 .TP
 \fB-P\fR[\fIpidfile\fR], \fB--pidfile\fR[\fB=\fIpidfile\fR]
 Causes a file (by default, \fBsecchan.pid\fR) to be created indicating